Use Unix socket for PostgreSQL

README.md

@@ -7,6 +7,7 @@ This configuration does not include some hardening configurations, as those are
 - snap ufw blocks Docker by default. ArcticFoxes's Matrix server uses .deb ufw instead.
 - A lot of these configuration files use ArcticFoxes's domain. If you are adopting this to your own system, make sure that you replace them.
 - The Certbot-OCSP-Fetcher script can be found [here](https://github.com/GrapheneOS/infrastructure/blob/main/certbot-ocsp-fetcher)
+- You need to create a `postgres-socket` and add the `postgres` and `matrix-synapse` user to it.
 - Systemd overrides for NGINX and SSHD services are based on [GrapheneOS's configurations](https://github.com/GrapheneOS/infrastructure/tree/main/systemd/system).
 - Systemd override for Synapse is based on Arch Linux's [matrix-synapse](https://gitlab.archlinux.org/archlinux/packaging/packages/matrix-synapse/-/blob/main/override-hardened.conf?ref_type=heads) package.
 - The repolists of PostgreSQL and Docker have been modified so that they read GPG keys from `/usr/share/keyring` by default. Make sure that when you follow upstream's documentation on adding their GPG keys, you adjust the location. For PostgreSQL's GPG key, run `curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /usr/share/keyrings/postgresql-debian-repo.gpg >/dev/null`

etc/matrix-synapse/homeserver.yaml

@@ -25,11 +25,10 @@ listeners:
 database:
   name: psycopg2
   args:
-    user: synapse
-    password: REDACTED
-    host: 127.0.0.1
-    database: synapse
-    port: 5432
+    user: 'synapse'
+    password: 'REDACTED'
+    host: '/var/run/postgresql'
+    database: 'synapse'
     cp_min: 5
     cp_max: 10
 log_config: "/etc/matrix-synapse/log.yaml"

etc/postgresql/15/main/conf.d/unix-socket.conf

@@ -0,0 +1,7 @@
+# Do not listen on IP interfaces
+listen_addresses = ''
+
+unix_socket_directories = '/var/run/postgresql'
+
+unix_socket_group = 'postgres-socket' # Create new group and add both postgres and matrix-synapse to it
+unix_socket_permissions = 0660